In this post
Quick answer
What happened to Google’s Privacy Sandbox advertising APIs?
Topics, Protected Audience, and Attribution Reporting were designed to support interest-based advertising, remarketing, and conversion measurement with less cross-site tracking. Google changed direction in 2025 and is now deprecating and removing all three APIs, while Chrome continues to offer users its existing third-party cookie controls.
- Topics grouped recent browsing activity into broad interest categories processed by the browser.
- Protected Audience stored interest groups and ran remarketing ad auctions inside the browser.
- Attribution Reporting connected ad interactions with conversions through privacy-limited reports.
- Google cited ecosystem feedback, expected value, and low adoption when announcing the APIs’ retirement.
- CHIPS, FedCM, and Private State Tokens remain supported, but they do not directly replace these advertising functions.
- Marketers should prioritise consented first-party data, contextual targeting, and resilient measurement systems.
Bottom line: These APIs are no longer a deployment roadmap, but their privacy principles remain useful for designing trustworthy advertising and measurement.
1. The Core Shift: Moving DataOff Servers and Onto Devices
Before diving into the specific APIs, it helps to understand the core philosophy of the Privacy Sandbox. Traditionally, third-party cookies allowed advertisers to build a centralized profile of you on their servers by tracking your movements across the web.
The Privacy Sandbox aimed to flip this model. Instead of sending your data to advertisers, the advertising logic was pushed down to your browser. Your browser (Chrome) became the gatekeeper, holding your data securely and only sharing exactly what was needed.
Feature | The Old Way (Third-Party Cookies) | The Privacy Sandbox Way |
Interest Targeting | Tracked your specific browsing history across the web. | Broad, anonymous topics stored locally on your device. |
Retargeting | Advertisers followed your identity from site to site. | Ad auctions happened securely inside your browser. |
Ad Measurement | Direct, real-time link between your click and purchase. | Delayed, aggregated reports to mask individual identities. |
2. The Topics API: Private Interest-Based Advertising
The Goal
To show you relevant ads based on what you like, without letting anyone know exactly which websites you visit.
How It Worked
Instead of tracking your granular movements, your browser analyzed your web history locally each week and assigned you a few broad categories or “Topics” such as Fitness, Travel, or Automotive.
When you visited a website with ad spaces, your browser would randomly select one of your top Topics and share it with the site and its advertisers.
- The Analogy: Imagine going to a bookstore. Instead of the cashier logging every single book you pull off the shelf, a librarian simply hands you a badge that says “Loves Sci-Fi.” Advertisers can offer you a sci-fi book, but they have no idea what specific titles you looked at previously.
- The Privacy Win: Your specific browsing history never left your device, and Topics reset every three weeks so outdated interests didn’t follow you indefinitely.
3. The Protected Audience API: Secure Retargeting
The Goal
To allow brands to retarget you (e.g., showing you an ad for those shoes you left in your cart) without using cross-site tracking. This was originally known as FLEDGE.
How It Worked
If you visited an online shoe store, that website could ask your browser to add you to a specific “interest group” (e.g., Running Shoe Shoppers). Later, when you visited a completely different site, like a news blog, the ad space on that blog would trigger a miniature ad auction.
The crucial difference? The auction happened directly on your device. Your browser securely accepted bids from advertisers, determined that you were in the Running Shoe Shoppers group, and chose the winning ad.
- The Analogy: It’s like an exclusive club membership card that you keep in your wallet. When you walk into a mall, the stores check your wallet locally to see if you qualify for a discount, rather than the mall broadcasting your identity to every store in the city.
- The Privacy Win: Advertisers could still serve you highly relevant remarketing ads, but they never learned exactly where else you were browsing.
4. The Attribution Reporting API: Measuring Success Safely
The Goal
To help advertisers figure out if their ads actually resulted in a sale (conversions) without tracking an individual user’s journey across the web.
How It Worked
When you clicked on an ad, your browser generated a secure, encrypted “note” acknowledging the click. If you later bought the product on the advertiser’s website, the browser matched the purchase to that initial note.
Instead of sending this confirmation back to the advertiser immediately, the browser added “noise” (randomized data) to the result, bundled it with other users’ data, and sent it on a delay.
- The Analogy: Think of it like a secret ballot box. The advertiser knows that someone in the neighborhood bought their product after seeing a billboard, but they can’t trace the receipt back to your specific house.
- The Privacy Win: It broke the direct chain of identity between an ad click on Site A and a purchase on Site B, protecting against covert fingerprinting.
5. Why Did Google Shut Down the Privacy Sandbox?
If these tools were so revolutionary, why did Google officially pull the plug on the initiative in late 2025?
- Regulatory Scrutiny: Competition watchdogs, particularly the UK’s Competition and Markets Authority (CMA), worried that making Chrome the ultimate gatekeeper of ad auctions would give Google an unfair monopoly over the digital ad market.
- Industry Pushback: Ad-tech companies and publishers reported that the APIs were overly complex to implement and often resulted in lower targeting precision (and lower revenues) compared to traditional cookies.
- The Pivot to User Choice: Ultimately, Google decided to leave third-party cookies intact while leaning into a consent-driven model, pushing the industry to focus on robust Consent Management Platforms (CMPs) and first-party data rather than relying entirely on browser-level restrictions.
6. The Bottom Line
The Privacy Sandbox may have been retired as a mandatory standard, but it proved that on-device processing and cryptographic privacy are technically viable. The digital marketing world has permanently shifted, and the surviving strategies now revolve around earning consumer trust, relying heavily on first-party data, and utilizing contextual advertising.
Frequently Asked Questions About Google’s Privacy Sandbox APIs
What was Google’s Privacy Sandbox?
Google’s Privacy Sandbox was a collection of technologies intended to support online advertising, audience targeting, and campaign measurement with less cross-site tracking. Its main advertising APIs included Topics, Protected Audience, and Attribution Reporting.
Is Google’s Privacy Sandbox still active?
Google is deprecating and removing the Topics, Protected Audience, and Attribution Reporting APIs. Some technologies developed under the Privacy Sandbox initiative, including CHIPS, FedCM, and Private State Tokens, continue to be supported.
What was the Topics API?
The Topics API used recent browsing activity to assign a browser a limited number of broad interest categories. Participating websites could access selected topics without receiving the user’s complete browsing history.
What was the Protected Audience API?
Protected Audience was a browser-based system for remarketing and custom audience advertising. It stored interest-group membership and conducted ad auctions inside the browser, reducing the need to share individual browsing activity across websites.
How did Attribution Reporting work?
The Attribution Reporting API connected advertising interactions, such as views or clicks, with later conversions. It used delayed and privacy-limited reports to make individual users more difficult to identify.
Did Google remove third-party cookies from Chrome?
No. Google decided to maintain Chrome’s existing approach to third-party cookie choice instead of introducing a universal phaseout or a new standalone consent prompt. Users can manage third-party cookies through Chrome’s privacy and security settings.
Why did Google retire these Privacy Sandbox APIs?
Google said it retired the APIs after reviewing ecosystem feedback, their expected value, and their low levels of adoption. The company announced the decision in October 2025.
What Privacy Sandbox technologies does Google still support?
Google continues to support CHIPS, FedCM, and Private State Tokens. These technologies address areas such as partitioned cookies, federated identity, and fraud prevention rather than directly replacing the retired advertising APIs.
What should marketers use instead of the retired APIs?
Marketers should prioritise consented first-party data, contextual targeting, transparent data practices, and measurement systems that do not depend on a single browser technology. These approaches can improve resilience while supporting stronger customer trust.
Are the retired APIs still relevant to marketers?
Yes. Topics, Protected Audience, and Attribution Reporting remain useful examples of privacy-conscious design. Their approaches to on-device processing, data minimisation, aggregation, and identity protection can inform future advertising and measurement technologies.
NEED HELP WITH PRIVACY-FIRST MARKETING?
At EBIG, we approach data strategy the same way we approach marketing overall: carefully, transparently, and with long-term growth in mind.
No shortcuts. No vague promises. Just sustainable first-party data building that supports real business goals.
If you want marketing strategies that make sense for your brand, not just for a compliance checklist 👉 let’s talk.